What this endpoint does

Retrieves detailed information for multiple Malware Report alerts in a single request (up to 250 alert IDs). These alerts are triggered when new sandbox analysis results match your configured monitoring rules — for example, when samples with specific behavioral patterns, malware families, or risk thresholds are detected. Use the Playbook Alerts: Search endpoint with category malware_report to discover alert IDs. The optional panels parameter lets you request only specific data sections ("status", "summary", or "log"). For single-alert retrieval, use the Playbook Alerts: Malware Report Detail endpoint. To investigate specific sample hashes further, use the Malware Intelligence: Get Sandbox Reports endpoint with the SHA-256 values from the matched_hashes array.

Response data

Each alert contains panel-organized data: panel_evidence_summary provides the core intelligence — the number of matching reports, an array of matched_hashes each containing a SHA-256 hash, Recorded Future risk score, enterprise submission flag, and report overviews with sandbox scores and classification tags (malware families, MITRE techniques, packers); detected_malwares lists the malware families found with occurrence counts; and sandbox_scores provides score distribution data. The panel_status provides alert metadata and panel_log_v2 tracks the change history.